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AMENDMENTS TO THE CLAIMS: 

This listing of claims will replace all prior versions, and listings, of claims in the 
application: 

LISTING OF CLAIMS 

1 . (Currently Amended) A method for correlating a first sensor to a second sensor 
in an intrusion detection system, the first sensor and the second sensor each 
maintaining belief regarding a resource or service monitored by the intrusion detection 
system, the method comprising the steps of: 

(a) transmitting to the first sensor information about a belief state of the 
second sensor, said belief state of the second sensor indicating a probabilistic belief 
regarding a current state of at least one system resource or service directly monitored 
by the second sensor; and 

(b) adjusting a belief state of the first sensor, said belief state of the first 
sensor indicating a probabilistic belief regarding a current state of at least one system 
resource or service directly monitored by the first sensor, the adjusting based at least in 
part on the belief state of the second sensor, so that a sensitivity of the first sensor to a 
suspicious activity in the intrusion detection system is improved. 

2. (Previously Presented) The method of claim 1 wherein the first sensor and the 
second sensor are different types of sensors. 

3. (Original) The method of claim 2 wherein the first sensor is a probabilistic 
sensor. 

4. (Currently Amended) A method for reducing false alarms generated by an 
intrusion detection system when a monitored resource is degraded or compromised, the 
intrusion detection system having a first sensor and a second sensor each maintaining 
belief regarding a state of a resource monitored by the intrusion detection system, the 
method comprising the steps of: 
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(a) transmitting to the first sensor all or part of a probabilistic belief of the 
second sensor regarding an apparent normal, degraded or compromised current state 
of a resource directly monitored by the second sensor; and 

(b) adjusting a belief state of the first sensor, said belief state of the first 
sensor indicating a probabilistic belief regarding an apparent normal, degraded or 
compromised current state of a resource directly monitored by the first sensor, so that 
an erroneous transaction with the degraded or compromised resource does not 
generate an alarm in the intrusion detection system. 

5. (Currently Amended) A method for enhancing a sensitivity of an intrusion 
detection system that monitors a plurality of computer system resources, the intrusion 
detection system having a first sensor and a second sensor each maintaining belief 
regarding a service monitored by the intrusion detection system, the method comprising 
the steps of: 

(a) transmitting to the first sensor all or part of a belief state of the second 
sensor indicating a probabilistic belief regarding an a current existence or validity of 
services supported on computer system resources directly monitored by the second 
sensor; and 

(b) adjusting a belief state of the first sensor, said belief state of the first 
sensor indicating a probabilistic belief regarding aft a current existence or validity of 
services supported on computer system resources directly monitored by the first sensor 
so that an attempted communication with a nonexistent system service or resource 
appears suspicious to the intrusion detection system. 

6. - 9. (Cancelled) 

10. (Currently Amended) A computer r e adable storage m e dium sensor device 
containing an executable program for correlating a first sensor to a second sensor in an 
intrusion detection system, the first sensor and the second sensor each maintaining 
belief regarding a resource or service monitored by the intrusion detection system, 
where the program performs the steps of: 

(a) transmitting to the first sensor information about a belief state of the 
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second sensor, said belief state of the second sensor indicating a probabilistic belief 
regarding a current state of at least one system resource or service directly monitored 
by the second sensor; and 

(b) adjusting a belief state of the first sensor, said belief state of the first 
sensor indicating a probabilistic belief regarding a current state of at least one system 
resource or service directly monitored by the first sensor, the adjusting based at least in 
part on the belief state of the second sensor, so that a sensitivity of the first sensor to a 
suspicious activity in the intrusion detection system is improved. 

11. (Currently Amended) A comput e r r e adab le storag e m e dium sensor device 
containing an executable program for reducing false alarms generated by an intrusion 
detection system when a monitored resource is degraded or compromised, the intrusion 
detection system having a first sensor and a second sensor each maintaining belief 
regarding a state of a resource monitored by of the intrusion detection system, where 
the program performs the steps of: 

(a) transmitting to the first sensor all or part of a probabilistic belief of the 
second sensor regarding an apparent normal, degraded or compromised current state 
of a resource directly monitored by the second sensor; and 

(b) adjusting a belief state of the first sensor, said belief state of the first 
sensor indicating a probabilistic belief regarding an apparent normal, degraded or 
compromised current state of a resource directly monitored by the first sensor so that an 
erroneous transaction with the degraded or compromised resource does not generate 
an alarm in the intrusion detection system. 

12. (Currently Amended) A comput e r r e adabl e storag e m e d i um sensor device 
containing an executable program for enhancing a sensitivity of an intrusion detection 
system that monitors a plurality of computer system resources, the intrusion detection 
system having a first sensor and a second sensor each maintaining belief regarding a 
service monitored by the intrusion detection system, where the program performs the 
steps of: 

(a) transmitting to the first sensor all or part of a belief state of the second 
sensor indicating a probabilistic belief regarding an a current existence or validity of 
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services supported on computer system resources directly monitored by the second 
sensor; and 

(b) adjusting a belief state of the first sensor, said belief state of the first 
sensor indicating a probabilistic belief regarding an a current existence or validity of 
services supported on computer system resources directly monitored by the first sensor 
so that an attempted communication with a nonexistent system service or resource 
appears suspicious to the intrusion detection system. 

13. (Cancelled) 



